US seizes more domains with ties to suspected Iranian influence campaign

Iran's Islamic Revolutionary Guard Corps unlawfully used the domains in operations to "covertly influence" opinions in the U.S. and elsewhere, says the Department of Justice.

The U.S. Department of Justice’s actions against alleged Iranian influence campaigns continued this week with the seizure of 27 internet domains, including four that the feds say were targeted directly at U.S. audiences.

Iran’s Islamic Revolutionary Guard Corps (IRGC) unlawfully used the domains in operations to “covertly influence” opinions in the U.S. and elsewhere, the department said in an announcement Wednesday. In early October, the feds seized 92 domains under similar allegations. Later that month, the Treasury Department sanctioned five Iran-linked organizations for spreading disinformation and making other attempts to sow discord in the U.S.

As with previous announcements, U.S. officials cited help from Silicon Valley giants.

“Thanks to our ongoing collaboration with Google, Facebook, and Twitter, the FBI was able to disrupt this Iranian propaganda campaign and we will continue to pursue any attempts by foreign actors to spread disinformation in our country,” said FBI Special Agent in Charge Craig Fair.

This week’s announcement does not mention the 2020 U.S. elections, nor did the Justice Department’s Oct. 8 statement about the previous domain seizures. The law enforcement actions come, however, as the U.S. presidential election remains undecided and federal agencies are on high alert for foreign meddling and misinformation as several states are counting votes.

The Oct. 22 Treasury sanctions announcement did cite election interference. It came the day after U.S. intelligence agencies assessed that threatening emails sent to Florida voters had originated in Iran. A week later, federal officials said Iranian hackers had probed the election systems of at least 10 states.

All 27 domains in the latest takedown were “registered with U.S.-based domain registrars and used top-level domains owned by U.S.-based registries,” according to the Justice statement, making them subject to several U.S. laws that restrict Iran’s economic activity in the U.S., including the International Emergency and Economic Powers Act and the Iranian Transactions and Sanctions Regulations.

DOJ said the four domains allegedly aimed at U.S. audiences — rpfront.com, ahtribune.com, awdnews.com and criticalstudies.org — were in violation of the Foreign Agents Registration Act, a transparency law that governs the political activities of representatives of foreign entities in the U.S.

In a separate affidavit, the FBI said the domains had connections to the Liberty Front Press network, an alleged influence campaign that was first outed in 2018 by cybersecurity company FireEye.

U.S. officials continue to urge vigilance as the election results are still coming in. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency is running a “rumor control” page for debunking misinformation.

The Iranian regime’s interest in digital influence and espionage operations extends well beyond the U.S. Cybersecurity researchers recently linked Iran to spearphishing emails sent to large swaths of potential attendees of the Munich Security Conference as well as the Think 20 Summit in Saudi Arabia.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure